Dear Maintainer,

I would like to submit three low-severity security hardening patches for
the debian/postinst maintainer script. These are defense-in-depth
improvements identified during a security code review. While none represent
exploitable vulnerabilities in normal deployment scenarios, they improve
robustness and satisfy security best practices.

The patches are available on salsa.debian.org at:
https://salsa.debian.org/superm1/base-files/-/tree/debian/SWSPLAT-23612
https://salsa.debian.org/superm1/base-files/-/tree/debian/SWSPLAT-23614
https://salsa.debian.org/superm1/base-files/-/tree/debian/SWSPLAT-23616

**Patch 1: Prevent symlink attacks in log file initialization**
Branch: debian/SWSPLAT-23612

The ensure_file_owner_mode() function (lines 4-10) creates and sets
ownership of system log files (wtmp, btmp, lastlog) but does not check
whether the target path is a symlink before modifying it. While exploiting
this requires write access to /var/log (normally root-only), it represents
a theoretical TOCTOU vulnerability during package installation.

Fix: Add explicit symlink check that refuses to operate on symlinks, and
use chown -h to avoid dereferencing.

**Patch 2: Quote DPKG_ROOT expansion in chmod**
Branch: debian/SWSPLAT-23614

Line 100 invokes chmod with an unquoted $DPKG_ROOT expansion, unlike every
other reference in the script. If DPKG_ROOT contains IFS whitespace or glob
characters, the argument would word-split or glob-expand.

Fix: Add quotes around the variable expansion to match the rest of the
script.

**Patch 3: Replace MD5 with SHA-256 for file integrity checks**
Branch: debian/SWSPLAT-23616

The update_to_current_default() function uses MD5 to decide whether to
overwrite /etc/profile and /root/.profile. MD5 is cryptographically broken
for collision resistance. While the check is not used as a security control
(it's a "did the admin customize this file?" heuristic), using SHA-256
improves crypto hygiene and silences security scanners.

Fix: Replace md5sum with sha256sum and use grep -qxF for anchored
fixed-string matching.

not called anywhere. I would rather drop the function as a cleanup
measure.

Patch 3 is incomplete and therefore wrong: Using sha256sum alone will
not work unless there is a matching file with the sha256sums of old
files, which your patch misses completely. To do it "right", one would
have to recalculate those hashes on the old files using the new
function, but given that there is no real security gain in doing so,
I'm not going to change it at this point. (People do not replace their
working /etc/profile file by another file having the same md5sum as an
old version just for fun).

[ Did you really generate the patch without actually understanding how
  the code works? ]

Only patch 2 makes sense, I will apply it in 14.3, whenever that will
happen.

Thanks.

Thanks - yeah dropping makes a lot more sense then.
🤦

Yeah; good point.

I didn't really think about it from upgrade flows, which yeah is on me.

Just drop the nonsense patch.  Sorry for the noise on this one.

Thanks!